Windows Analysis Report
https://gjyefv.degaris.com/

Overview

General Information

Sample URL:	https://gjyefv.degaris.com/
Analysis ID:	1432311

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

HTML body contains low number of good links

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Signatures

Phishing

Phishing site detected (based on favicon image match)

Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://gjyefv.degaris.com/

HTTP Parser: Base64 decoded: https://fbzxki.furnart-gh.com/nxnqadacitlupmhzteqjtsozfgekznozsano

HTML title does not match URL

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0hip9/0x4AAAAAAAYXr8fowNoxx5DP/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0hip9/0x4AAAAAAAYXr8fowNoxx5DP/auto/normal	HTTP Parser: No favicon
Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No favicon

Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.208.86.120:443 -> 192.168.2.18:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12

Source: global traffic	DNS traffic detected: DNS query: gjyefv.degaris.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fbzxki.furnart-gh.com
Source: global traffic	DNS traffic detected: DNS query: www.furnart-gh.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: xzbgjm.furnart-gh.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.208.86.120:443 -> 192.168.2.18:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49766 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@16/31@26/161

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gjyefv.degaris.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1924,i,15390962331566012590,5812943106349818764,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1924,i,15390962331566012590,5812943106349818764,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.178.50.36	www.google.com	United States	15169	GOOGLEUS	false
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
192.178.50.67	unknown	United States	15169	GOOGLEUS	false
13.107.246.41	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.178.50.78	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
104.21.28.181	fbzxki.furnart-gh.com	United States	13335	CLOUDFLARENETUS	false
104.131.80.170	gjyefv.degaris.com	United States	14061	DIGITALOCEAN-ASNUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.64.227	unknown	United States	15169	GOOGLEUS	false
142.250.64.138	unknown	United States	15169	GOOGLEUS	false
104.17.3.184	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
23.193.106.20	unknown	United States	16625	AKAMAI-ASUS	false
142.250.217.174	unknown	United States	15169	GOOGLEUS	false
74.125.26.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.67.147.16	www.furnart-gh.com	United States	13335	CLOUDFLARENETUS	false
13.107.213.41	part-0013.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.64.170	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.2.184	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.18

Contacted Domains

Name	IP	Active
fbzxki.furnart-gh.com	104.21.28.181	true
part-0013.t-0009.t-msedge.net	13.107.213.41	true
xzbgjm.furnart-gh.com	104.21.28.181	true
a.nel.cloudflare.com	35.190.80.1	true
www.furnart-gh.com	172.67.147.16	true
cs1100.wpc.omegacdn.net	152.199.4.44	true
cdnjs.cloudflare.com	104.17.24.14	true
gjyefv.degaris.com	104.131.80.170	true
challenges.cloudflare.com	104.17.3.184	true
www.google.com	192.178.50.36	true
identity.nel.measure.office.net	unknown	unknown
aadcdn.msftauth.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gjyefv.degaris.com/	false		unknown
https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0hip9/0x4AAAAAAAYXr8fowNoxx5DP/auto/normal	false		high
https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	true		unknown
about:blank	false	Avira URL Cloud: safe	low

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 17:46:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	B3D242FAEDE46588FBB389B5FDF4CC8D	5BDD7CBC9318375D9DD8E0A1F0E0D8E90B23081A	5ED73B676CFD6568122019E9AE83E24CD397BAB5EE8DC9E485C99B27B590455C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 17:46:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	EE2D78D4A52622E45A6FDB8ED962BB2B	272794A18839D023F2F9877D27D19B7C7D902735	9E71216BA1A64102F8297F1CCDE8B866348BA56AA86A3EE45BD6CE671146A16B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 09:23:19 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	19F96905ACC9A274427C1C83A5136E90	A3543B79E26066DE79ABF0FE4444CBBB259FF36D	74C0C0184883FD08283DE7F92A6C53CFE3D16FE41B2EAC13B1349275D16E68A3
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 17:46:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	592F5B652BCA39BC410BC586DE1BEAAA	68DBF713EC0B7418747EE6669CDCB26231181BF5	6157F123D67CBC4A8B1F8FBC9B654554FCD9578803B9357B3B74854486F2C139
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 17:46:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	33381EF2D5928A9DEBD725351C067A3F	396CE56EEB29CBD547F64FDB34B4B7DFD4D34D0B	2CF728BC2CDEEBE63FF146CB9DDB85EBBC4DAE518635EB55393BCC2CE0354318
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 17:46:16 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	C5AE754AE0E4542CC41D20CA1EFA5BAC	1A849AF2424D00B77EC426AD97CF05C0CC9A3BF1	468A98EA8C49E2111ADADBBA8940C8A3E95137FFB3BB7911139DBCD98637355E
Chrome Cache Entry: 102	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15708	98421BE6893CF3AA929C5F6C4A0C5C67	2BB411BB6B6C31AE02B81F199C90219717F718AF	019D26044CCF18F979DFBB8677828FA36BF5CBFC529CECD942644CFE86D90D04
Chrome Cache Entry: 103	GIF image data, version 89a, 352 x 3	166DE53471265253AB3A456DEFE6DA23	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
Chrome Cache Entry: 104	ASCII text, with very long lines (47992), with no line terminators	CF3402D7483B127DED4069D651EA4A22	BDE186152457CACF9C35477B5BDDA5BCB56B1F45	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
Chrome Cache Entry: 105	GIF image data, version 89a, 352 x 3	B540A8E518037192E32C4FE58BF2DBAB	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
Chrome Cache Entry: 106	HTML document, ASCII text	A943672A32297727BAB01C3E76977550	3A667C4B7A457EF6C586CC581D533C128737BF53	B9347F234DC3C8D56E015E86D88A1400415DB8F7A5AD91F02B6A2323C10A4187
Chrome Cache Entry: 107	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864	0E176276362B94279A4492511BFCBD98	389FE6B51F62254BB98939896B8C89EBEFFE2A02	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
Chrome Cache Entry: 109	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors	12E3DAC858061D088023B2BD48E2FA96	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
Chrome Cache Entry: 110	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced	9246CCA8FC3C00F50035F28E9F6B7F7D	3AA538440F70873B574F40CD793060F53EC17A5D	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
Chrome Cache Entry: 78	HTML document, ASCII text, with very long lines (2337), with CRLF line terminators	11C2064477D2A188500214B4039393EC	00CC7AE89EEEB08C6AE3FCCBB524720253B4C150	27C298064F1398BF0CC724D210900AA1C80D075D2473380DAD445722EF1B8E05
Chrome Cache Entry: 80	ASCII text, with very long lines (42414)	F94A2211CE789A95A7C67E8C660D63E8	F1FC19B6BCB96D0A905BF3192AAFF0885FF9F36F	926DC3302F99EC05E4206E965DDEB7250F5910A8C38E82C7BEAFB724BBAAF37B
Chrome Cache Entry: 81	ASCII text, with no line terminators	9D422EDF7FC3020496DA4F02D19B219C	A2EBA939970EC4B48DACE77D0549F7E1A5DA3E98	8E23A348E140C65D43C5B5506B658226933FAAA405D44D1D8D18F8ABB0DB7B17
Chrome Cache Entry: 82	PNG image data, 22 x 61, 8-bit/color RGB, non-interlaced	D411A58EEE994203CFB4D647CF009036	12CE16DB61AF69C6628E45B40412E604CAD2E732	37615F758E77462B1961C4633BF68D233C4EC8DAC37D1E3FBCA00D1BF93CDF0E
Chrome Cache Entry: 83	ASCII text, with no line terminators	9F9FA94F28FE0DE82BC8FD039A7BDB24	6FE91F82974BD5B101782941064BCB2AFDEB17D8	9A37FDC0DBA8B23EB7D3AA9473D59A45B3547CF060D68B4D52253EE0DA1AF92E
Chrome Cache Entry: 84	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651	9F368BC4580FED907775F31C6B26D6CF	E393A40B3E337F43057EEE3DE189F197AB056451	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
Chrome Cache Entry: 85	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113657	57911010756C90D58754C91EF1EE2765	BAA48FEF4866D7DAFD9F59417745EE838F0E63CA	87C5385BA17F84CC25FB7BBE1EDB4169BC702842BD74B758ACDC130986D55BC2
Chrome Cache Entry: 87	HTML document, ASCII text	E34B0BFA20742FF4E680A88C0A8DF48E	107F0C417E9721ECF474F63ACB0ABF1C7E9D72AB	C8A1D25D964B8535A2D4FE62522B39B0CC2680022AA67FFE5BF20AB338A34990
Chrome Cache Entry: 88	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113084	92A840DC3D177339DAE03FEDF22A22B5	C1C9A6E6442388D07A9D9D72C12DA25094D6920F	4A986BA8875F22A0EABC356112A6790F90E114ADB72EAEC4632E03812EC1EDE4
Chrome Cache Entry: 90	ASCII text, with very long lines (7851), with no line terminators	CD95F6DAC859C61AFB4B0234E20D3604	C24FD1346B003968E269929A6EE9DDE33F9A593F	D5F0FFF9E15AFFC211C6850EB476D27237B1F27C64223215112CC21EC9C81B93
Chrome Cache Entry: 92	ASCII text, with very long lines (45563)	0A1A5BA009FB1F25E3F3D036D8CF26CE	8E9E6A11CED0807252C34DCA1D8C7C2390D1A5CA	94153F2A6DAAE35DFCB61DC987E2D4310B7CA021E36375E87D8B8C641C0C6121
Chrome Cache Entry: 93	Unicode text, UTF-8 text, with very long lines (29406), with no line terminators	90AA11F39700C7D82563B7ED3F011856	B32A6989BBB50CD94CA22508225902E74D882A5F	4BF52E1F92CE9EA93F33025943D00DBFE5E73FF1C8DDC1507AEE8AC82D34DC0F
Chrome Cache Entry: 94	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 223759	799F880143F17E47C4EFDBB3FF35A54C	8CECC74EB422322F78EDE1111F175A28725CCA9F	EA70CC2977F4DEB5236041A7A0628FA671FB8AD20A5E9E3FD6885A11359EF2FE
Chrome Cache Entry: 95	HTML document, ASCII text, with very long lines (2337), with CRLF line terminators	9F4019F1559E08F8794CEE8232CF13F7	C2FE9F6BB0C7D1672F6307664D627C9C9C9BE650	69FB43AC691DFF49CA716D3610E96CC2D5F3B9239CA71247B2A10836DEF6FF47
Chrome Cache Entry: 97	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 444227	0868DA2DD5EFFED92904047439E49D48	D760173E5E6B25461B0D2A0B32D384FE659B2338	8C41E973CB5EE0194EBF3BAA0716EEEB57EED53552F042E200190E3C37F08CFD
Chrome Cache Entry: 98	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 55071	978A6C1AA934E5B1C5320D515FD25662	64636EF3E1AD607F095DBA6CB01447AC133B483D	D1963B1837F4087E988FD18BB4CF25B38D61D675C4B6A6FC01158BD39945F10A
Chrome Cache Entry: 99	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592	4761405717E938D7E7400BB15715DB1E	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF

Phishing

Phishing site detected (based on favicon image match)

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 4.8.pages.csv, type: HTML
Source: Yara match	File source: 4.9.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Matcher: Found strong image similarity, brand: MICROSOFT

HTML body contains low number of good links

HTTP Parser: Number of links: 0

HTML page contains hidden URLs or javascript code

Source: https://gjyefv.degaris.com/

HTTP Parser: Base64 decoded: https://fbzxki.furnart-gh.com/nxnqadacitlupmhzteqjtsozfgekznozsano

HTML title does not match URL

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0hip9/0x4AAAAAAAYXr8fowNoxx5DP/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/0hip9/0x4AAAAAAAYXr8fowNoxx5DP/auto/normal	HTTP Parser: No favicon
Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No favicon

Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://fbzxki.furnart-gh.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638497539916693231.NzQwNWZlMDItNTFiNS00ZDM1LWFmZWYtOWJiMzU5NzZiZTQ1NTFkNGVjZGEtNzIyYS00ZmZkLThlMGUtNWYzN2QxY2Y4YTBm&ui_locales=en-US&mkt=en-US&client-request-id=991a96c5-61cc-4dd9-bcb3-1b9fc4a44d55&state=-J25bmtWK5ujB1PmjRLNfkgKzegmK6ukQWfpBQSWdqcZVqYgJkVh8ry1FJQ1eS3LFW6ybOMIiLCWdBZr_7XEs4lcjCpFz5hnMxDYIY8B8WJoWW-yOzFN-LXlrLmUHiAL3ZnBFZKir9x-78g9_-BUltqok7DpuCAbHoxI7tebZuI4W88Vt9CfQImUftBsISrf49v_vB2RgHNCr9HZEMZMaWK-AOodaB2WsittDwwf98gMVdOAsh8iQjg0piyZjXwsWuLPQpG7HJ0bIYbXdWgMzQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.208.86.120:443 -> 192.168.2.18:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49766 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.28.12

Source: global traffic	DNS traffic detected: DNS query: gjyefv.degaris.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fbzxki.furnart-gh.com
Source: global traffic	DNS traffic detected: DNS query: www.furnart-gh.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: xzbgjm.furnart-gh.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.28.12:443 -> 192.168.2.18:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.208.86.120:443 -> 192.168.2.18:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.204.76.112:443 -> 192.168.2.18:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.18:49766 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@16/31@26/161

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://gjyefv.degaris.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1924,i,15390962331566012590,5812943106349818764,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1924,i,15390962331566012590,5812943106349818764,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

ID:	1432311
Product:	CloudBasic
Start time:	20:45:17
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://gjyefv.degaris.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://gjyefv.degaris.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://gjyefv.degaris.com/